Skip to content

Event ID 1003: Unable to read system shutdown configuration information from the registry

Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.

Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.

Try: 4625, 4624, 4740, 6008, 41, 1074, 7045, 1102, 4104, 1149

Unable to read system shutdown configuration information from the registry.

Event 1003
WER-SystemErrorReporting
System log
Error
Message and fields (as Event Viewer shows them) 
Unable to read system shutdown configuration information from the registry.

The following DNS server(s) were successfully validated as active servers that can service this client.

Event 1003
DNS-Client
System log
Information
Message and fields (as Event Viewer shows them) 
The following DNS server(s) were successfully validated as active servers that can service this client. …

Diagnostic informational event on a Controller on device(Port

Event 1003
StorPort
System log
Information
Message and fields (as Event Viewer shows them) 
Diagnostic informational event on a Controller on device(Port = …).                    
Adapter Guid: …                    
Miniport driver name: …                    
SubsystemId: …                    
ControllerId: …                    
TransportType: …                    
TransportAddress: …                    
ProductId: …                    
Firmware revision: …                    
Description: …

The Windows Resource Exhaustion Detector received a notification that the computer is low on virtual memory.

Event 1003
Resource-Exhaustion-Detector
System log
Warning
Message and fields (as Event Viewer shows them) 
The Windows Resource Exhaustion Detector received a notification that the computer is low on virtual memory.

The remote desktop client '…' has provided an invalid license.

Event 1003
TerminalServices-RemoteConnectionManager
TerminalServices-RemoteConnectionManager/Operational log
Warning
Message and fields (as Event Viewer shows them) 
The remote desktop client '…' has provided an invalid license.

… scan has been paused.

Event 1003
Windows Defender
Windows Defender/Operational log
Information
Message and fields (as Event Viewer shows them) 
… scan has been paused.
 	Scan ID: …
 	Scan Type: …
 	Scan Parameters: …
 	User: …\…

The server received an unencrypted message from client when encryption was required.

Event 1003
SMBServer
SMBServer/Operational log
Error
Message and fields (as Event Viewer shows them) 
The server received an unencrypted message from client when encryption was required. Message was rejected.

Client Name: …
Client Address: …
User Name: …
Session ID: …
Share Name: …

Guidance:

This event indicates that a client is sending unencrypted data even though the SMB share requires encryption.